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THE CLAIMS 

For the convenience of the Examiner, all pending claims of the present Application 
are shown below whether or not an amendment has been made. 

1 . (Cancelled) 

2. (Currently Amended) The method of claim 1 claim 5 , wherein the system 
resource usage comprises a number of processes that each of the one or more applications 
have spawned and the predetermined criteria comprises exceeding a predetermined limit on 
the number of processes that each of the one or more applications may spawn. 

3 . (Currently Amended) The method of claim 1 claim 5 , wherein: 
monitoring at a kernel level system resource usage of one or more running 

applications comprises monitoring a parent-child relationship between one or more running 
processes and each of the one or more applications; and 

determining whether the system usage pattern of the first application satisfies a 
predetermined criteria associated with one or more problems comprises determining whether 
the first application has oiphaned one of the one or more running processes, wherein an 
orphaned process is one wherein a child process is running even though a corresponding 
parent process associated with the child process is not running. 

4. (Currently Amended) The method of claim 1 claim 5 , wherein the system 
resource usage comprises memory usage of the one or more running applications. 

5. (Currently Amended) The method of claim 1, wherein: A method of 
identifying problems in applications com prising: 

monitoring at a kernel level system resource usage of one or more running 
applications without modifying run-time enviro nments of the one or more applications; 

from the system resource usage, determining a m emory usage pattern for each of 
a plurality of applications, each memory usage pattern indicating for a selected one of 
the running applications: 

a first memory usage amount during a first tim e period; 
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a second memory usage amount during a second time period; and 

a change in the memory usage of the selected one of the plurality of 

applications from the first time period to a second time period, the change in the 

memory usage equaling the difference between the first memory usage amount and the 

second memory usage amount; 

determining whether the change in the memory usage of the selected one of the 

plurality of applications satisfies a predetermined criteria associated with one or more 

problems; and 

if the change in the memory usage of the selected one of the plurality of 
applications satisfies the predetermined criteria, identifying the selected one of the 
plurality of applications to a user, and 

wherein the one or more applications comprise one or more user applications initiated 

at the user level; and 

wherein monitoring at a kernel level system resource usage of one or more running 
applications comprises monitoring at a kernel level system resource usage of one or more 
running processes belonging to one or more user applications wherein the one or more 
running processes comprise one or more processes initiated at the kernel level by the one or 
more user applications, the system resource usage comprising kernel space memory used by 
each of the plurality of user applications. 

6. (Currently Amended) The method of c laim 1 claim 5, wherein the system 
resource usage of the one or more running applications is monitored over a plurality of 
consecutive discrete time periods. 
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7. (Currently Amended) A method of identifying pro ble m s in ap plications, 
comprising The method of claim 6, wherein : 

monitoring at a kernel level system resource usage of one or more running 
applications without modifying run time environments of the one or more applications, 
wherein the system resource usage of the one or more running applications i s m emtored 
over a plurality of consecutive discrete time periods; 

determining a system resource usage pattern of a fir s t application , th e s yst em 
resource usage pattern indicating a change in the system usag e of t he first ap plfeatkm 
from a first time period to a second time period, the system resource usage comprises an 
amount of memory usage for each of the one or more applications; and 

determining whether the change in the sy s tem resource usage of the first 
application satisfies a predetermined criteria associated with one or mor e probl ems the 
predetermined criteria is a limit on a number of memory increase s memory usage increases 
allowed during the plurality of time periods^-a»4 

if the change in the system resource usage of the fir s t application s atisfi es the 
predetermined criteria, identifying the first application to a user . 

8. (Previously Presented) The method of claim 6, wherein: 

the system resource usage comprises an amount of memory usage for each of the one 
or more applications; and 

the predetermined criteria is a generally continuous increase in the amount of memory 
usage during the plurality of time periods. 

9. (Previously Presented) The method of claim 6, wherein: 

the system resource usage comprises a number of processes that each of the plurality 
of applications have spawned; and 

the predetermined criteria is a generally continuous increase in the number of child 
processes spawned during the plurality of time periods. 
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10. (Currently Amended) The method of claim 1 claim 5 , wherein identifying the 
first application the selected one of the plurality of applications to a user comprises 
saving an identifier of the first application the selected one of the plurality of applications 

in a reference file, and further comprising saving identifiers of any other of the plurality of 
applications whose system usage pattern satisfies a predetermined criteria associated with one 
or more problems in the reference file. 

11. (Currently Amended) The method of claim 10, wherein a computer 
automatically: 

monitors the kernel level system resource usage of one or more running applications; 

determines whether a memory usage pattern of a first applicati on the selected one of 
the plurality of applications satisfies a predetermined criteria associated with one or more 
problems; and 

identifies the first application the selected one of the plurality of applications. 
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12. (Currently Amended) A method of identifying memory problems in 
applications, comprising: 

monitoring at a kernel level memory usage of a plurality of running applications 
without modifying run-time environment of the applications, the memory usage indicating for 
each of the plurality of running applications: 

a first memory usage amount during a first time period; 
a second memory usage amount during a second time period; and 
producing an output comprising at least the memory usage; and 

determining a change in the memory usage of a first applicatio n-^v4*hin— the 
plurality of applications the plurality of running applications , the change in the memory 
usage indicating a change in the memory usage of the first application at least one running 
application from a first time period to a second time period, the change in the memory usage 
equaling the difference between the first memory usage amount and the second memory 
usage amount; 

determining whether the change in the memory usage of the first application at least 
one running application satisfies a predetermined criteria associated with one or more 
problems; and 

if the change in the memory usage of the first application at least one running 
application satisfies the predetermined criteria, identifying the first application to a u ser at 
least one running application to a user, 

wherein the plurality of running applications comprise a plurality of user 
applications initiated at the user level, and 

wherein monitoring, at the kernel level, memo ry usage of the plurality of 
running applications comprises monitoring, at the kernel level, memory usage of one or 
more running processes belonging to the plurality of user applications, the one or more 
running processes being initiated at the kernel level by the plurality of user applications, 
the memory usage comprising kernel space memory used by each of the plurality of 
user applications . 
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13. (Currently Amended) The method of claim 12, wherein: 

the memory usage of the one or more plurality of running processes is monitored 
over a plurality of consecutive discrete time periods, and 

the predetermined criteria is a limit on a number of memory increases allowed during 
the plurality of time periods. 

14. (Currently Amended) A system for identifying memory problems in 
applications, comprising a computer operable to: 

monitor at a kernel level memory usage of one or more running applications without 
modifying run-time environments of the one or more applications; 

produce an output comprising at least the memory usage of one or more applications; 

determining a memory usage pattern of a first application, the memory usage pattern 
indicating a change in the memory usage of the first application from a first time period to a 
second time period; 

determine whether the change in the memory usage of the first application satisfies a 
predetermined criteria associated with one or more problems; and 

if the change in the memory usage of the first application satisfies the predetermined 
criteria, identify the first application by saving an identifier of the first application in a 

reference file file, and 

wherein the one or more runni n g applications comprise one or more user 

applications initiated at the us er level, and 

wherein monitoring at the ker n el level, memory usage of the one or more 
running applications comprises monitoring, at the kernel level, memory usage of one or 
more running processes belonging to the o ne or more user applications, the one or more 
running processes initiated at the kernel l evel bv the one or more user applications, the 
memory usage comprising kernel space m emory used by each of the one or more user 
applications . 
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15. (Currently Amended) A method of identifying memory problems in 
applications, comprising: 

monitoring at a kernel level memory usage of a plurality of running applications 
without modifying run-time environments of the running applications, the memory usage 
indicating for each of the plurality of running applications: 

a first memory usage amount during a first time period; and 
a second memory usage amount during a second time period; 
determining a memory usage pattern of a first application within the plurality of 
applications, the change a change in the memory usage indicating a change in the memory 
usage of the first application from a first time period to a second time period, the change in 
the memory usage equaling the difference between the first memory usage amount and the 
second memory usage amount; 

determining whether the change in the memory usage of the first application satisfies 
a predetermined criteria associated with one or more problems; and 

if the change in the memory usage of the first application satisfies the predetermined 
criteria, identifying the first rmmmg application without identifying the one or more 
riming applications whose memory usage patterns do not satisfy the predetermined criteria 
associated with the one or more memory problems, and 

wherein the plurality of running appli c ations comprise a plurality of user 
applications initiated at the us er level, and 

wherein monitoring, at the kernel level, memory usage of the plurality of 
running applications comprises monit o ring, at the kernel level, memory usage of a 
plurality of running processes belonging to the plura lity of user applications, each of the 
plurality of running processes initiated at the k e rnel level by a one of the plurality of 
user applications, the memory usage c omprising kernel space memory used by each of 
the plurality of user applications . 

16. (Original) The method of claim 15, wherein the monitored memory usage 
comprises at least a stack memory, data memory, and text memory. 
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17. (Currently Amended) A method of identifying memory problems in 
applications, comprising: 

collecting system resource usage at a kernel level of one or more running processes 
belonging to one or more running applications without modifying run-time environments of 
the one or more «ser running applications; 

from the system resource usage, determining a memory usage pattern of each of a 
plurality of applications, each memory usage pattern indicating for a selected one of the 
plurality of applications: 

a first memory usage amount during a first time period; 
a second memory usage amount during a second time period; and 
a change in the memory usage of the selected one of the plurality of 
applications from the first time period to the second time period, the change in the memory 
usage equaling the difference between the first memory usage amount and the second 
memory usage amount; 

determining whether a chang e the change in the memory usage of a first 
^ppliontinn within the selected one of the plurality of applications satisfies a predetermined 
criteria associated with one or more problems; and 

if the change in the memory usage of the first application the selected one of the 
nluralitv of applications satisfies the predetermined criteria, identifying the first 
application the selected one of the plurality of ap plications to a use ri and 

wherein the one or more running appl ications comprise one or more user 
applications initiated at the user level; and 

wherein the one or more running proc esses comprise one or more processes 
initiated at the kernel level bv the one or more user applications, the system resource 
usage comprising kernel space mem o ry used by each of the one or more user 
applications . 
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18. (Currently Amended) A system for identifying problems in applications, 
comprising: 

a data collection module operable to retrieve information about a plurality of running 
user-applications at a kernel level, the information comprising: 

a first memory usage amount during a first time period; 

a second memory usage amount during a second time period; and 

a change in the memory usage of the selected one of the plurality of running 
user applications from the first time period to the second time period, the change in the 
memory usage equaling the difference between the first memory usage amount and the 
second memory usage amount; and 

a data analysis module operable to: 

determine abnormal system usage pattern in the information based on the 
difference between the first memory usage amount and the second memory usage amount; 
and 

identify a first user application associated with the abnormal usage pattern that 
satisfies a predetermined criteria associated with one or more problems^and 

wherein the plurality of running user applica tions are initiated at the user level, 
wherein the first memory usage comprises kernel space memory used by the 
selected one of the plurality of running use r a pp li cations during the first time period 
and 

wherein the second memory usa^e comprises kernel space m emory used by the 
selected one of the plurality of running use r applica tions d uring the second time period . 
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19. (Cancelled) 

20. (Currently Amended) The program storage device of claim 19, A program 
storage device readable by a machine, tangibly embodying a program of instructions 
executable by the machine to perform method step s of identifying problems in 
applications, comprising: 

monitoring, at a kernel level, system resource usage of one or more running 
applications without modifying run-time environmen ts of the one or more applications; 

from the system resource usage, determining a memory usa ge pattern for each of 
a plurality of applications, each memory usage p attern indicating for a selected one of 
the plurality of applications: 

a first memory usage amount during a first tim e period; 
a second memory usage amount during a seco nd time period; and 
» change in the memory usage of the sel ected one of the plurality of 
applications from the first time perio d to a second time period, the change in the 
memory usage equaling the difference between the first memory usage amount and the 
second memory usage amount; 

determining whether the change in the m emory usage of the selected one of the 
plurality of annlications satisfies a prede t ermined criteria associated with one or more 
problems; and 

if the change in the memory usage of t he selected one of the plurality of 
annlications satisfies the predetermined criteria, identifying the selected one of the 
plurality of applications to a user, and 

wherein the system resource usage comprises a parent-child relationship between one 
or more processes and each of the one or more applications; and 

determining whether a system usage pattern of a first application the selected one of 
the plurality of applications satisfies a predetermined criteria associated with one or more 
problems comprises determining whether the first application the selected one of the 
plurality of applications has orphaned one of the one or more running processes, wherein an 
orphaned process is one wherein a child process is running even though a corresponding 
parent process associated with the child process is not running. 
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21. (Currently Amended) The method of Claim 1 claim 5 , wherein determining 
whether a memory usage pattern of the first application satisfies a predetermined criteria 
associated with one or more problems comprises: 

comparing the memory usage for the first application against the predetermined 

criteria; and 

selecting the first application from the one or more running applications if the 
memory usage pattern of the first application satisfies the predetermined criteria. 

22. (Previously Presented) The method of Claim 1 claim 5, wherein each 
memory usage pattern for each of the plurality of applications comprises: 

the amount of memory in a first region being used by a process to store text; 
the amount of memory in a second region being used by the process to store data; and 
the amount of memory in a third region being used by the process to store stack 
memory. 

23 . (Previously Presented) The method of C laim 1 claim 5, wherein: 
monitoring system resource usage comprises monitoring memory usage by each of 

the plurality of applications over a plurality of consecutive discrete time periods; 

determining whether a change in the memory usage of the first application comprises 
determining that an amount of memory usage for the first application has increased during a 
plurality of consecutive discrete time periods; and 

diagnosing a memory leak associated with the first application in response to 
determining that the amount of memory usage for the first application has increased during 
the plurality of consecutive discrete time periods. 

24. (Cancelled) 

25. (Currently Amended) The method of €4a4m cjaim 12, wherein the memory 
usage of the one or more running applications comprises: 

the amount of memory in a first region being used by a process to store text; 

the amount of memory in a second region being used by the process to store data; and 
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the amount of memory in a third region being used by the process to store stack 
memory. 

26. (Currently Amended) The method of Claim claim 1 2, wherein: 
monitoring memory usage comprises monitoring memory usage by each of the 

plurality of running applications over a plurality of consecutive discrete time periods; 

determining whether a change in the memory usage of the first application comprises 
determining that an amount of memory usage for the first application has increased during a 
plurality of consecutive discrete time periods; and 

diagnosing a memory leak associated with the first application in response to 
determining that the amount of memory usage for the first application has increased during 
the plurality of consecutive discrete time periods. 

27. (Currently Amended) The system of Claim claim 14, wherein the memory 
usage of the one or more running applications comprises: 

the amount of memory in a first region being used by a process to store text; 
the amount of memory in a second region being used by the process to store data; and 
the amount of memory in a third region being used by the process to store stack 
memory. 

28. (Currently Amended) The system of €teim claim 14, wherein: 
monitoring memory usage comprises monitoring memory usage by each of the 

plurality of running applications over a plurality of consecutive discrete time periods; 

determining whether a change in the memory usage of the first application comprises 
determining that an amount of memory usage for the first application has increased during a 
plurality of consecutive discrete time periods; and 

diagnosing a memory leak associated with the first application in response to 
determining that the amount of memory usage for the first application has increased during 
the plurality of consecutive discrete time periods. 

29. (Currently Amended) The program storage device of Claim claim 19, 
wherein the memory usage of the one or more running applications comprises: 
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the amount of memory in a first region being used by a process to store text; 
the amount of memory in a second region being used by the process to store data; and 
the amount of memory in a third region being used by the process to store stack 
memory. 

30. (Currently Amended) The program storage device of Claim claim 19, 
wherein: 

monitoring memory usage comprises monitoring memory usage by each of the 
plurality of running applications over a plurality of consecutive discrete time periods; 

determining whether a change in the memory usage of the first application comprises 
determining that an amount of memory usage for the first application has increased during a 
plurality of consecutive discrete time periods; and 

diagnosing a memory leak associated with the first application in response to 
determining that the amount of memory usage for the first application has increased during 
the plurality of consecutive discrete time periods. 
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